CVE-2026-90620

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

HTTPoxyScan

HTTPoxy Exploit Scanner by 1N3 @CrowdShield https://crowdshield.com Last Updated: 20160720 ABOUT: PoC/Exploit scanner to scan common CGI files on a target URL for the HTTPoxy vulnerability. Httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments...

r00kie-kr00kie

r00kie-kr00kie Disclaimer This is a PoC exploit for the CVE-2019-15126 kr00k vulnerability. This project is intended for educational purposes only and cannot be used for law violation or personal gain. The author of this project is not responsible for any possible harm caused by the materials...

CVE-2026-90617

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function runtask of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible ...

autoscan

autoscan.sh Overview autoscan.sh is fully automated penetration test tool linked with Metasploit, nmap and other free avialable tools and report all of this in faraday faraday is one tool, you can use it for other open source reporting tools, an example is to export it in jira. Autoscan identifie...

cve

CVE PoC Almost every publicly available CVE PoC. Current hottest CVEs...

T3MP3ST

🌩️ T3MP3ST 🌩️ root@kitploit: ▄▄▄█████▓▓█████ ███▄ ▄███▓ ██▓███ ▓█████ ██████ ▄▄▄█████▓ ▓ ██▒ ▓▒▓█ ▀ ▓██▒▀█▀ ██▒▓██░ ██▒▓█ ▀ ▒██ ▒ ▓ ██▒ ▓▒ ▒ ▓██░ ▒░▒███ ▓██ ▓██░▓██░ ██▓▒▒███ ░ ▓██▄ ▒ ▓██░ ▒░ ░ ▓██▓ ░ ▒▓█ ▄ ▒██ ▒██ ▒██▄█▓▒ ▒▒▓█ ▄ ▒ ██▒░ ▓██▓ ░ ▒██▒ ░ ░▒████▒▒██▒ ░██▒▒██▒ ░ ░░▒████▒▒██████▒▒ ▒██▒ ░...

CVE-2026-90615 SourceCodester Class and Exam Timetabling System subject1.php cross site scripting

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed...

kernelpop

kernelpop kernelpop is a framework for performing automated kernel vulnerability enumeration and exploitation on the following operating systems: Linux Mac It is designed to be python version-agnostic, meaning that it should work with both python2 and python3 please let me know if you find that i...

qsreplace

qsreplace Accept URLs on stdin, replace all query string values with a user-supplied value, only output each combination of query string parameters once per host and path. Usage Example input file: root@kitploit: ▶ cat urls.txt https://example.com/path?one=1&two=2...

CVE-2026-90613

GPAC (component MP4Box ) contains a reachable assertion vulnerability in the function stbl_GetSampleInfos within the file isomedia/stbl_read.c , affecting versions up to commit f1219cde. The attack requires a local position with low privileges and results in a low availability impact (denial of s...

CVE-2026-90607

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote. The exploit is no...

gef

GEF pronounced ʤɛf - "Jeff" is a set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit...

cve-search

cve-search cve-search is a tool to import CVE Common Vulnerabilities and Exposures and CPE Common Platform Enumeration into a MongoDB to facilitate search and processing of CVEs. The main objective of the software is to avoid doing direct and public lookups into the public CVE databases. Local...

CVE-2021-1675

CVE-2021-1675 - PrintNightmare LPE PowerShell Caleb Stewart | John Hammond | July 1, 2021 CVE-2021-1675 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare." Proof-of-concept exploits have been released Python, C++ for the remote code execution...

Ponce

Ponce Ponce pronounced 'poN θe pon-they is an IDA Pro plugin that provides users the ability to perform taint analysis and symbolic execution over binaries in an easy and intuitive fashion. With Ponce you are one click away from getting all the power from cutting edge symbolic execution. Entirely...

PAVELOW

PAVELOW Exploit Toolbox. Programmed by Xecurity. Language: BASH Description: PAVELOW helps you with your exploiting and vulnerability searching adventures on KALI Linux by using a few different pre-installed tools among several others that PAVELOW will installed & setup for youthey all can be fou...

ida-pro-mcp

IDA Pro MCP Simple MCP Server to allow vibe reversing in IDA Pro. https://github.com/user-attachments/assets/6ebeaa92-a9db-43fa-b756-eececce2aca0 The binaries and prompt for the video are available in the mcp-reversing-dataset repository. Prerequisites Python 3.11 or higher Use idapyswitch to...

EUVD-2026-77140

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The...

EUVD-2026-77127

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/supedit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been...